Redirection of USB devices from hardware isolated virtual desktop infrastructure clients

ABSTRACT

USB devices can be redirected from hardware isolated VDI clients. When a VDI client is run in a hardware isolated environment, a notification service can also be run in the hardware isolated environment to enable a USB device that is not accessible within the hardware isolated environment to be redirected to a server on which the VDI client has established a remote session. In some cases, an agent can also be employed in the hardware isolated environment to temporarily redirect the USB device to the hardware isolated environment for use in establishing the remote session before the USB device is redirected to the server. Similar techniques can be employed to redirect a USB device to a hardware isolated environment so that the USB device can be accessed by an application running in the hardware isolated environment.

CROSS-REFERENCE TO RELATED APPLICATIONS

N/A

BACKGROUND

The present invention is generally directed to techniques forredirecting USB devices in a virtual desktop infrastructure (VDI)environment. USB device redirection generally refers to making a USBdevice that is connected to a client accessible within a virtual desktopas if the USB device had been physically connected to the virtualdesktop. In other words, when USB device redirection is implemented, auser can connect a USB device to his or her client terminal and the USBdevice will function as if it had been connected to the server.

FIGS. 1 and 2 and the following description will provide a generaloverview of how USB device redirection can be implemented in accordancewith some embodiments of the present invention. In FIG. 1, a computingsystem 100 is depicted as including a number of client terminals 102a-102 n (referenced generally herein as client(s) 102) in communicationwith a server 104 via a network 106. Server 104 can be configured tosupport a remote session (e.g., a remote desktop session) wherein a userat a client 102 can remotely access applications and data at the server104 from the client 102. Such a connection may be established using anyof several well-known techniques such as the Remote Desktop Protocol(RDP) and the Citrix® Independent Computing Architecture (ICA).

Client terminal 102 may represent a computer, a mobile phone (e.g.,smart phone), a laptop computer, a thin client terminal, a personaldigital assistant (PDA), a portable computing terminal, or a suitableterminal or device with a processor. Server 104 may represent acomputer, a laptop computer, a computing terminal, a virtual machine(e.g., VMware® Virtual Machine), a desktop session (e.g., MicrosoftTerminal Server), a published application (e.g., Microsoft TerminalServer) or a suitable terminal with a processor.

Client 102 may initiate a remote session with server 104 by sending arequest for remote access and credentials (e.g., login name andpassword) to server 104. If server 104 accepts the credentials fromclient 102, then server 104 may establish a remote session, which allowsa user at client 102 to access applications and data at server 104.During the remote session, server 104 sends display data to client 102over network 106, which may include display data of a desktop and/or oneor more applications running on server 104. The desktop may include, forexample, icons corresponding to different applications that can belaunched on server 104. The display data allows client 102 to locallydisplay the desktop and/or applications running on server 104.

During the remote session, client 102 may send user commands (e.g.,inputted via a mouse or keyboard at client 102) to server 104 overnetwork 106. Server 104 may process the user commands from client 102similar to user commands received from an input device that is local toserver 104. For example, if the user commands include mouse movements,then server 104 may move a pointer on the desktop running on server 104accordingly. When the display data of the desktop and/or applicationchanges in response to the user commands, server 104 sends the updateddisplay data to client 102. Client 102 locally displays the updateddisplay data so that the user at client 102 can view changes at server104 in response to the user commands. Together, these aspects allow theuser at client 102 to locally view and input commands to the desktopand/or application that is running remotely on server 104. From theperspective of the client, the desktop running on server 104 mayrepresent a virtual desktop environment.

FIG. 2 is a block diagram of a local device virtualization system 200 inaccordance with embodiments of the present invention. System 200 mayinclude client 102 in communication with server 104 over network 106 asillustrated in FIG. 1. Client 102 may include a proxy 210, a stub driver220, and a bus driver 230. Client 102 can be connected to a device 240,as shown in FIG. 2. Server 104 may include an agent 250 and a virtualbus driver 260.

In accordance with USB device redirection techniques, while device 240is not locally or physically connected to server 104 and is remote toserver 104, device 240 appears to server 104 as if it is locallyconnected to server 104, as discussed further below. Thus, device 240appears to server 104 as a virtual device 290.

By way of illustration and not limitation, device 240 may be any type ofUSB device including a machine-readable storage medium (e.g., flashstorage device), a printer, a scanner, a camera, a facsimile machine, aphone, an audio device (e.g., a headset), a video device (e.g., acamera), a peripheral device, or other suitable device that can beconnected to client 102. Device 240 may be an external device (i.e.,external to client 102) or an internal device (i.e., internal to client102).

Bus driver 230 can be configured to allow the operating system andprograms of client 102 to interact with device 240. In one aspect, whendevice 240 is connected to client 102 (e.g., plugged into a port ofclient 102), bus driver 230 may detect the presence of device 240 andread information regarding device 240 (“device information”) from device240. The device information may include features, characteristics andother information specific to device 240 such as a device descriptor(e.g., product ID, vendor ID and/or other information), a configurationdescriptor, an interface descriptor, an endpoint descriptor and/or astring descriptor. Bus driver 230 may communicate with device 240through a computer bus or other wired or wireless communicationsinterface.

In accordance with USB device redirection techniques, device 240 may beaccessed from server 104 as if the device were connected locally toserver 240. Device 240 may be accessed from server 104 when client 102is connected to server 104 through a remote session running on server104. For example, device 240 may be accessible from the desktop runningon server 104 (i.e., virtual desktop environment). To enable this, busdriver 230 may be configured to load stub driver 220 as the defaultdriver for device 240. Stub driver 220 may be configured to report thepresence of device 240 to proxy 210 and to provide the deviceinformation (e.g., device descriptor) to proxy 210. Proxy 210 may beconfigured to report the presence of device 240, along with the deviceinformation, to agent 250 of server 104 over network 106 (e.g., via aTCP or UDP socket). Thus, stub driver 220 redirects device 240 to server104 via proxy 210.

Agent 250 may be configured to receive the report from proxy 210 thatdevice 240 is connected to client 102 and the device information. Agent250 may further be configured to associate with the report from proxy210 one or more identifiers for client 102 and/or for a remote sessionthrough which client 102 is connected to server 104, such as a sessionnumber or a session locally unique identifier (LUID). Agent 250 canprovide notification of device 240, along with the device information,to virtual bus driver 260. Virtual bus driver 260 (which may be a DellWyse TCX USB bus driver, or any other bus driver) may be configured tocreate and store in memory a record corresponding to device 240. Thisrecord may include at least part of the device information and sessionidentifiers received from agent 250. Virtual bus driver 260 may beconfigured to report to operating system 170 of server 104 that device240 is connected and to provide the device information to the operatingsystem. This allows the operating system of server 104 to recognize thepresence of device 240 even though device 240 is connected to client102.

The operating system of server 104 may use the device information tofind and load one or more appropriate device drivers for device 240 atserver 104. Each driver may have an associated device object (object(s)281 a, 281 b, . . . , 281 n, referred to generally as device object(s)281), as illustratively shown in FIG. 2. A device object 281 is asoftware implementation of a real device 240 or a virtualized (orconceptual) device 290. Different device objects 281 layer over eachother to provide the complete functionality. The different deviceobjects 281 are associated with different device drivers (driver(s) 282a, 282 b, . . . 282 n, referred to generally as device driver(s) 282).In an example, a device 240 such as a USB flash drive may haveassociated device objects including objects corresponding to a USBdriver, a storage driver, a volume manager driver, and a file systemdriver for the device. The device objects 281 corresponding to a samedevice 240 form a layered device stack 280 for device 240. For example,for a USB device, a USB bus driver will create a device object 281 astating that a new device has been plugged in. Next, a plug-and-play(PNP) component of the operating system will search for and load thebest driver for device 240, which will create another device object 281b that is layered over the previous device object 281 a. The layering ofdevice objects 281 will create device stack 280.

Device objects 281 may be stored in a memory of the server 104associated with virtual bus driver 260. In particular, device objects281 and resulting device stack 280 may be stored in random-access memoryof server 104. Different devices 240/290 can have device stacks havingdifferent device objects and different numbers of device objects. Thedevice stack may be ordered, such that lower level device objects(corresponding to lower level device drivers) have lower numbers thanhigher level device objects (corresponding to higher level devicedrivers). The device stack may be traversed downwards by traversing thestack from higher level objects to lower level objects. For example, inthe case of an illustrative device stack 280 corresponding to a USBflash drive, the ordered device stack may be traversed downwards from ahigh-level file system driver device object, to a volume manager driverdevice object, to a storage driver device object, to a USB driver deviceobject, and finally to a low-level virtual bus driver device object.Different device stacks 280 can be layered over each other to providethe functionality of the devices 240/290 inside devices, like USBHeadsets, or USB pen drives. A USB pen drive, for example, can create aUSB device stack first, over which it can create a storage device stack,where each of the device stacks have two or more device objects.

Once one or more device object(s) 281 are loaded by operating system 170of server 104, each device object 281 can create a symbolic link (alsoreferred to as a “device interface”) to device object 281 and associateddevice driver 282. The symbolic link is used by applications running onserver 104 to access device object 281 and device 240/290. The symboliclink can be created by a call to a function such asIoCreateSymbolicLink( ) including such arguments as a name for thesymbolic link, and a name of device object 281 or associated device 240.In one example, for example, a symbolic link to a USB flash drive device240 is created by a call from a device object 281 for device 240 to thefunction IoCreateSymbolicLink( ) including arguments “\\GLOBAL??\C:”(i.e., the name for the symbolic link) and “\Device\HarddiskVolume1”(i.e., a name of the device object).

The creation of a symbolic link results in an entry being created in anobject manager namespace (OMN) of operating system 170. The OMN storesinformation on symbolic links created for and used by operating system170, including symbolic links for devices 240, virtualized devices 290,and applications 270 running on server 104.

As a result of the symbolic link creation process, a symbolic link todevice 240 is enumerated in the OMN of server 104. Once the presence ofdevice 240 is reported to operating system 170 of server 104, device 240may be accessible from a remote session (and associated desktop) runningon server 104 (i.e., virtual desktop environment). For example, device240 may appear as an icon on the virtual desktop environment and/or maybe accessed by applications running on server 104.

An application 270 running on server 104 may access device 240 bysending a transaction request including the symbolic link for device 240to operating system 170. Operating system 170 may consult the ObjectManager Namespace to retrieve an address or other identifier for thedevice itself 240 or for a device object 281 associated with device 240.Using the retrieved address or identifier, operating system 170 forwardsthe transaction request for device 240 either directly, through a deviceobject 281 of device stack 280, and/or through virtual bus driver 260.Virtual bus driver 260 may direct the transaction request to agent 250,which sends the transaction request to proxy 210 over network 106. Proxy210 receives the transaction request from agent 250, and directs thereceived transaction request to stub driver 220. Stub driver 220 thendirects the transaction request to device 240 through bus driver 230.

Bus driver 230 receives the result of the transaction request fromdevice 240 and sends the result of the transaction request to stubdriver 220. Stub driver 220 directs the result of the transactionrequest to proxy 210, which sends the result of the transaction requestto agent 250 over network 106. Agent 250 directs the result of thetransaction request to virtual bus driver 260. Virtual bus driver 260then directs the result of the transaction request to application 270either directly or through a device object 281 of device stack 280.

Thus, virtual bus driver 260 may receive transaction requests for device240 from application 270 and send results of the transaction requestsback to application 270 (either directly or through a device object 281of device stack 280). As such, application 270 may interact with virtualbus driver 260 in the same way as with a bus driver for a device that isconnected locally to server 104. Virtual bus driver 260 may hide thefact that it sends transaction requests to agent 250 and receives theresults of the transaction requests from agent 250 instead of a devicethat is connected locally to server 104. As a result, device 240connected to client 102 may appear to application 270 as if the physicaldevice 240 is connected locally to server 104.

VDI client 255 can represent the client-side application thatestablishes and maintains a remote session with server 104. As examplesonly, VDI client 255 could represent the VMWare Horizon client, theCitrix Workspace App, the Microsoft Remote Desktop client, etc. FIG. 2represents a VDI environment where VDI client 255 is not hardwareisolated. For example, VDI client 255 may be a desktop application or abrowser-based application that runs on the host operating system andwill therefore have access to device 240 via the host operating system.Accordingly, when VDI client 255 establishes a remote session, it candirectly employ information about the remote session to cause device 240to be redirected to server 104 for access within the remote session.

To enhance security, applications may be run in a hardware isolatedenvironment. For example, Microsoft's Edge browser runs in a Hyper-Vcontainer which is a virtual machine that runs its own guest operatingsystem on which the Edge browser runs. In non-Windows environments,other hypervisors are commonly used to isolate the browser or otherapplications (e.g., running the Bromium browser or another applicationin a uXen, XenServer, or KVM virtual machine).

In comparison to FIG. 2, if VDI client 255 were run on client 102 in ahardware isolated environment, whether as an HTML5-based applicationthat runs in the browser or as a traditional desktop application, itwould not have access to client 102's physical hardware. To thecontrary, VDI client 255 would only have access to emulated hardwaresuch as an emulated keyboard and mouse. Because of this, when VDI client255 is run in a hardware isolated environment, current solutions do notprovide a way to redirect USB devices.

BRIEF SUMMARY

The present invention extends to methods, systems, and computer programproducts for redirecting USB devices from hardware isolated VDI clients.When a VDI client is run in a hardware isolated environment, anotification service can also be run in the hardware isolatedenvironment to enable a USB device that is not accessible within thehardware isolated environment to be redirected to a server on which theVDI client has established a remote session. In some cases, an agent canalso be employed in the hardware isolated environment to temporarilyredirect the USB device to the hardware isolated environment for use inestablishing the remote session before the USB device is redirected tothe server. Similar techniques can be employed to redirect a USB deviceto a hardware isolated environment so that the USB device can beaccessed by an application running in the hardware isolated environment.

In some embodiments, the present invention is implemented as a methodfor enabling a USB device that is connected to a client terminal to beaccessed within a remote session that a VDI client establishes on aserver when the VDI client runs in a hardware isolated environment onthe client terminal. A notification service that runs in the hardwareisolated environment receives connection information for the remotesession that the VDI client has established on the server. Thenotification service then sends the connection information for theremote session to a proxy that runs on the client terminal outside thehardware isolated environment. The proxy employs the connectioninformation for the remote session to redirect the USB device to theserver to thereby cause the USB device to become accessible within theremote session.

In some embodiments, the present invention is implemented as computerstorage media storing computer executable instructions which whenexecuted on a client terminal implement a method for enabling a USBdevice that is connected to a client terminal to be accessed within aremote session that a VDI client establishes on a server when the VDIclient runs in a hardware isolated environment on the client terminal.In response to the VDI client establishing the remote session on theserver, a notification service that runs in the hardware isolatedenvironment receives connection information for the remote session. Thenotification service sends the connection information for the remotesession to a proxy that runs on the client terminal outside the hardwareisolated environment. The proxy employs the connection information forthe remote session to redirect the USB device to the server to therebycause the USB device to become accessible within the remote session.

In some embodiments, the present invention is implemented as a methodfor enabling a USB device that is connected to a client terminal to beaccessed when an application runs in a hardware isolated environment onthe client terminal. In conjunction with the hardware isolatedenvironment being created on the client terminal, an agent is run in thehardware isolated environment. The agent sends connection informationfor the hardware isolated environment to a proxy that runs on the clientterminal outside the hardware isolated environment. The proxy employsthe connection information to redirect the USB device to the hardwareisolated environment to thereby cause the USB device to becomeaccessible to an application that runs in the hardware isolatedenvironment.

This summary is provided to introduce a selection of concepts in asimplified form that are further described below in the DetailedDescription. This Summary is not intended to identify key features oressential features of the claimed subject matter.

BRIEF DESCRIPTION OF THE DRAWINGS

Understanding that these drawings depict only typical embodiments of theinvention and are not therefore to be considered limiting of its scope,the invention will be described and explained with additionalspecificity and detail through the use of the accompanying drawings inwhich:

FIG. 1 illustrates an example computing environment in which the presentinvention can be implemented;

FIG. 2 illustrates a general architecture that may exist when a USBdevice is redirected from a client terminal to a server;

FIG. 3 illustrates an example of a hardware isolated environment inwhich a VDI client may be run;

FIGS. 4A-4D illustrate an example of how a USB device that is notaccessible to a VDI client running in a hardware isolated environmentcan be redirected to a server for access from a remote session that thehardware isolated VDI client established;

FIG. 5 illustrates another example of a hardware isolated environment inwhich a VDI client may be run;

FIGS. 6A-6E illustrate an example of how a USB device that is notaccessible to a VDI client running in a hardware isolated environmentcan be initially redirected to the hardware isolated environment for usein establishing a remote session on a server and subsequently redirectedto the server for access from the remote session;

FIG. 7 illustrates another example of a hardware isolated environment inwhich an application may be run and which can be configured to supportredirection of a USB device to allow the application to access the USBdevice; and

FIG. 8 illustrates another example of a hardware isolated environment inwhich an application may be run and which can be configured to supportredirection of a USB host controller to allow the application to accessany USB device that is connected to a corresponding USB port.

DETAILED DESCRIPTION

In this specification and the claims, the term “hardware isolatedenvironment” should be construed as an environment within a client thatisolates an application from the client's hardware. A hardware isolatedenvironment may oftentimes be created using a hypervisor and may be inthe form of a virtual machine. Common examples of hardware isolatedenvironments include Hyper-V containers, Bromium micro virtual machinesand Kernel-based Virtual Machines (KVMs), among many others.

FIG. 3 illustrates an example of a Windows-based hardware isolatedenvironment that may exist on client 102. In contrast to FIG. 2, in FIG.3, client 102 includes a hypervisor 300 that creates and runs virtualmachines on client 102. Client 102 is shown as including a parent (orroot) partition in which the host operating system (OS) is run. Notably,components running in the parent partition have access to hardwareresources including USB devices that may be connected to or integratedinto client 102. Such components include bus driver 230, stub driver 220and proxy 310. Proxy 310 can perform similar functionality as proxy 210but can be configured to support the functionality described below.Proxy 310, stub driver 220 and bus driver 230 can each be configured toload when the host OS is started.

Client 102 is also shown as including a child partition which is avirtual machine in which a guest OS is run. Unlike the parent partition,the child partition does not have direct access to client 102's hardwareresources. Accordingly, VDI client 255, which is run on the guest OSwithin the child partition, would not have access to device 240 eventhough it is connected to client 102. As mentioned above, VDI client 255could be a desktop application that runs directly on the guest OS orcould be a browser-based application that runs within a browser. As oneparticular example, if the Edge browser were employed on client 102 torun VDI client 255, the Edge browser would be launched within a childpartition in the manner shown in FIG. 3 so that VDI client 255 would berun in isolation.

A notification service 301 can also be run in the child partition withVDI client 255. For example, in Windows environments, a Hyper-Vcontainer can be created with a Windows base OS image that includes VDIclient 255 and notification service 301. As a result, whenever VDIclient 255 is launched on client 102, notification service 301 will alsobe launched and run concurrently with VDI client 255 within the childpartition. Similar techniques could be employed in non-Windows (ornon-Hyper-V) environments to ensure that notification service 301 runsconcurrently with VDI client 255 in the hardware isolated environment.For simplicity, server 104 is depicted in FIG. 3 without any of thecomponents that are shown in FIG. 2. Yet, server 104 could have the samearchitecture as shown in FIG. 2 or any architecture that would supportUSB redirection.

FIGS. 4A-4D provide an example of how the components depicted in FIG. 3can interact to enable device 240 to be accessed from a remote sessionthat VDI client 255 established on server 104. With reference to FIG.4A, in step 1, the host OS causes VDI client 255 to be launched in ahardware isolated environment. As an example, in a Windows environment,the user could select the Edge browser which in turn would cause host OSto create a child partition (or VM) and run the Edge browser therein.The user could then employ the Edge browser to run VDI client 255 (e.g.,by navigating to a particular website where an HTML5 VDI client isavailable). As another example, client 102 could be configured toautomatically create a hardware isolated environment (e.g., a VM orsimilar container) at startup and launch VDI client 255 therein, whetheras a desktop or web application. Regardless of how and when VDI client255 is launched within the hardware isolated environment, it will nothave access to device 240.

In accordance with embodiments of the present invention, notificationservice 301 can also be run within the hardware isolated environment andcan be configured to interface with VDI client 255 to enable device 240to become accessible within a remote session established by VDI client255 even though VDI client 255 is prevented from having access to USBdevice 240 on client 102. For example, in step 2, it is assumed that VDIclient 255 initiates a remote session on server 104. VDI client 255 canestablish this remote session in any suitable manner. Once the remotesession is established, agent 250 will be running on server 104 and, instep 3, can send back connection information for the remote session.This connection information may typically include an IP address ofserver 104 (which may typically be a VM), a port at which agent 250 islistening and a session ID of the remote session.

Turning to FIG. 4B, in step 4, notification service 301 receives theconnection information for the remote session from VDI client 255. As anexample, notification service 301 could be a .dll file, a .so file oranother type of file that is registered to be loaded as a virtualchannel endpoint when VDI client 255 is initialized. In such cases, aspart of loading, notification service 301 can register to receiveconnection information that is sent to VDI client 255. In any case, oncenotification service 301 receives the connection information for theremote session, in step 5, it sends the connection information to proxy310 that is not running in the hardware isolated environment. Forexample, notification service 301 and proxy 310 can be configured toestablish a private network (e.g., a Hyper-V private network) by whichnotification service 301 can send the connection information for theremote session to proxy 310.

Turning to FIG. 4C, once proxy 310 has received the connectioninformation for the remote session on server 104, in step 6, it canemploy this connection information to communicate with agent 250 toredirect device 240 to server 104 (i.e., to cause virtualized device 290to appear on server 104). Due to this redirection, device 240 willbecome accessible on server 104 within the remote session that VDIclient 255 has established. For example, if device 240 is a printer andthe user of client 102 causes Microsoft Word to be run in the remotesession, the user will be able to print Word documents to the printereven though the hardware isolated environment on client 102 prevents VDIclient 255 from accessing the printer.

Turning to FIG. 4D, when the session is terminated, VDI client 255 cannotify notification service 301. For example, as part of loading,notification service 301 can register with VDI client 255 to receivenotifications when a remote session is terminated. In response toreceiving notification that the remote session has terminated, in step7, notification service 301 can send a corresponding notification toproxy 310 to inform proxy 310 that the remote session has terminated. Inresponse, in step 8, proxy 310 can cause device 240 to be returned toclient 240. For example, in a Windows implementation, proxy 310 couldreturn device 240 to client 102 by sending anIOCTL_INTERNAL_USB_RESET_PORT I/O control request.

In the embodiments represented in FIGS. 3-4D, device 240 does not becomeaccessible to VDI client 255, but rather is accessible to server-sideapplications running within the remote session. However, in someenvironments, VDI client 255 may need access to device 240 in order toestablish a remote session on server 104 such as when device 240 is asmart card reader or other type of authentication device. FIG. 5illustrates how the hardware isolated environment of FIG. 3 can bemodified to enable VDI client 255 to access an authentication device 640that is physically connected to client 102 but inaccessible tocomponents in the hardware isolated environment. In addition toincluding VDI client 255 and notification service 301, the hardwareisolated environment in FIG. 5 also includes agent 550, virtual busdriver 560 and device stack 580. FIGS. 6A-6E provide an example of howthe components depicted in FIG. 5 can interact to initially enable VDIclient 255 to access and employ authentication device 640 to establish aremote session and then enable authentication device 640 to be accessedfrom the remote session.

Turning to FIG. 6A, in step 1, the host OS causes VDI client 255 to belaunched in the hardware isolated environment and is therefore similarto step 1 of FIG. 4A. However, in addition to launching VDI client 255and notification service 301, agent 550 and virtual bus driver 560 canalso be launched. Then, in step 2, agent 550 can send connectioninformation for the hardware isolated environment to proxy 310. Thisconnection information can include an IP address of the hardwareisolated environment (e.g., the IP address of a VM) and a port number onwhich agent 550 is listening.

Turning to FIG. 6B, in step 3, proxy 310 can employ the connectioninformation it received from agent 550 to redirect authentication device640 to the hardware isolated environment thereby causing virtualizedauthentication device 690 to appear to VDI client 255 as if it weredirectly connected to the hardware isolated environment. In step 4, VDIclient 255 can initiate a remote session on server 104 usingauthentication device 640. For example, if authentication device 640 isa smart card reader, VDI client 255 could access the user's smart cardto perform smart-card-based authentication as part of establishing theremote session on server 104. Once the remote session is established, instep 5, agent 250 can send connection information for the remote sessionto VDI client 255.

Turning to FIG. 6C, in step 6, notification service 301 can receive theconnection information for the remote session from VDI client 255 and,in step 7, send the connection information for the remote session toproxy 310 in a similar manner as described above. In step 8,authentication device 640 can be returned to the host OS (i.e., theredirection can be terminated). For example, when proxy 310 receives theconnection information for the remote session, it could reset the USBport to which authentication device 640 is connected and send anotification to agent 550 indicating that authentication device 640 hasbeen disconnected. In response, agent 550 could notify virtual busdriver 560 which in turn could notify the guest OS that authenticationdevice 690 is no longer connected thereby causing device stack 580 to beunloaded.

Turning to FIG. 6D, once authentication device 640 has been returned tothe host OS (e.g., once the USB port has been reset and the PnP processhas been initiated to reconnect authentication device 640), in step 9,proxy 310 can employ the connection information for the remote sessionto redirect authentication device 640 to server 104 so that it becomesaccessible within the remote session that VDI client 255 hasestablished. As a result, an application running in the remote sessionwill be able to access authentication device 640.

Turning to FIG. 6E, in step 10, notification service 301 can notifyproxy 310 when the remote session is terminated. In response, proxy 310can cause authentication device 640 to be returned to client 102 in asimilar manner as described above. Although FIGS. 6A-6E use the exampleof an authentication device 640, the same technique could be employedwith any type of USB device.

A similar technique could be employed to allow any type of applicationrunning in a hardware isolated environment on client 102 to obtainaccess to device 240. FIG. 7 illustrates an example of a hardwareisolated environment in which an application 700 is run. As an example,application 700 could be a browser (e.g., the Edge browser) or anotherapplication that host OS causes to be launched in a hardware isolatedenvironment. The hardware isolated environment depicted in FIG. 7 issimilar to the hardware isolated environment depicted in FIG. 5 but doesnot include (or does not need to include) notification service 301. Withthis configuration, steps similar to steps 1-3 of FIGS. 6A and 6B can beperformed to redirect device 240 to the hardware isolated environment toenable application 700 to access device 240. As an example, if device240 is a printer and application 700 is the Edge browser running in aHyper-V container, this technique will allow the Edge browser to printto the printer even though the hardware isolated environment preventsthe Edge browser from directly accessing USB devices that are connectedto client 102.

FIG. 7 represents a scenario where the USB device itself is redirected.However, in some implementations, a similar technique could be employedto redirect the USB host controller so that any USB device that isconnected to a particular USB port will be made accessible toapplication 700 within the hardware isolated environment. FIG. 8represents how this can be accomplished. In contrast to FIG. 7, FIG. 8includes a USB host controller driver 830 above which a stub driver 820is loaded in the parent partition. Also, a virtual USB host controllerdriver 860 is loaded in the hardware isolated environment and functionsas the virtual counterpart of USB host controller 830. A device stack880, which can be viewed as including a bus driver and the actualdriver(s) for device 240, will also be loaded in the hardware isolatedenvironment. Because redirection occurs at the host controller level, avirtualized USB port will appear in the hardware isolated environmentrepresenting the USB port to which device 240 is connected. As a result,any USB device that the user may connect to this “reserved” USB portwill be redirected to the hardware isolated environment and becomeaccessible to application 700.

Although not shown, in some embodiments, the hardware isolatedenvironments depicted above can be configured to implementapplication-level restrictions for accessing device 240/640. Forexample, the hardware isolated environments shown in FIGS. 5, 7 and 8could be configured to load a filter driver on device stack 580/880 thatinspects I/O requests targeting device 240 (or any other device that maybe redirected) and blocks any I/O request that originates from anunauthorized application.

Embodiments of the present invention may comprise or utilize specialpurpose or general-purpose computers including computer hardware, suchas, for example, one or more processors and system memory. Embodimentswithin the scope of the present invention also include physical andother computer-readable media for carrying or storingcomputer-executable instructions and/or data structures. Suchcomputer-readable media can be any available media that can be accessedby a general purpose or special purpose computer system.

Computer-readable media is categorized into two disjoint categories:computer storage media and transmission media. Computer storage media(devices) include RAM, ROM, EEPROM, CD-ROM, solid state drives (“SSDs”)(e.g., based on RAM), Flash memory, phase-change memory (“PCM”), othertypes of memory, other optical disk storage, magnetic disk storage orother magnetic storage devices, or any other similarly storage mediumwhich can be used to store desired program code means in the form ofcomputer-executable instructions or data structures and which can beaccessed by a general purpose or special purpose computer. Transmissionmedia include signals and carrier waves.

Computer-executable instructions comprise, for example, instructions anddata which, when executed by a processor, cause a general purposecomputer, special purpose computer, or special purpose processing deviceto perform a certain function or group of functions. The computerexecutable instructions may be, for example, binaries, intermediateformat instructions such as assembly language or P-Code, or even sourcecode.

Those skilled in the art will appreciate that the invention may bepracticed in network computing environments with many types of computersystem configurations, including, personal computers, desktop computers,laptop computers, message processors, hand-held devices, multi-processorsystems, microprocessor-based or programmable consumer electronics,network PCs, minicomputers, mainframe computers, mobile telephones,PDAs, tablets, pagers, routers, switches, and the like.

The invention may also be practiced in distributed system environmentswhere local and remote computer systems, which are linked (either byhardwired data links, wireless data links, or by a combination ofhardwired and wireless data links) through a network, both performtasks. In a distributed system environment, program modules may belocated in both local and remote memory storage devices. An example of adistributed system environment is a cloud of networked servers or serverresources. Accordingly, the present invention can be hosted in a cloudenvironment.

The present invention may be embodied in other specific forms withoutdeparting from its spirit or essential characteristics. The describedembodiments are to be considered in all respects only as illustrativeand not restrictive. The scope of the invention is, therefore, indicatedby the appended claims rather than by the foregoing description.

What is claimed:
 1. A method for enabling a USB device that is connectedto a client terminal to be accessed within a remote session that avirtual desktop infrastructure (VDI) client establishes on a server whenthe VDI client runs in a hardware isolated environment on the clientterminal, the method comprising: receiving, at a notification servicethat runs in the hardware isolated environment, connection informationfor the remote session that the VDI client has established on theserver; sending, by the notification service, the connection informationfor the remote session to a proxy that runs on the client terminaloutside the hardware isolated environment; employing, by the proxy, theconnection information for the remote session to redirect the USB deviceto the server to thereby cause the USB device to become accessiblewithin the remote session.
 2. The method of claim 1, wherein theconnection information for the remote session includes an IP address ofthe server and a port number of an agent that runs on the server.
 3. Themethod of claim 1, wherein the notification service receives theconnection information for the remote session from the VDI client via avirtual channel.
 4. The method of claim 1, wherein the hardware isolatedenvironment is a virtual machine.
 5. The method of claim 1, furthercomprising: receiving, at the notification service, a notification thatthe remote session has terminated; sending, by the notification service,a corresponding notification to the proxy; and in response to thecorresponding notification, causing, by the proxy, the USB device to bereturned to the client terminal.
 6. The method of claim 1, wherein theVDI client runs in a browser in the hardware isolated environment. 7.The method of claim 1, further comprising: sending, by an agent thatruns in the hardware isolated environment, connection information forthe hardware isolated environment to the proxy; employing, by the proxy,the connection information for the hardware isolated environment toredirect the USB device to the hardware isolated environment to therebycause the USB device to become accessible within the hardware isolatedenvironment.
 8. The method of claim 7, wherein the proxy redirects theUSB device to the hardware isolated environment prior to redirecting theUSB device to the server.
 9. The method of claim 8, wherein thenotification service receives the connection information for the remotesession while the USB device is redirected to the hardware isolatedenvironment.
 10. One or more computer storage media storing computerexecutable instructions which when executed on a client terminalimplement a method for enabling a USB device that is connected to aclient terminal to be accessed within a remote session that a virtualdesktop infrastructure (VDI) client establishes on a server when the VDIclient runs in a hardware isolated environment on the client terminal,the method comprising: in response to the VDI client establishing theremote session on the server, receiving, at a notification service thatruns in the hardware isolated environment, connection information forthe remote session; sending, by the notification service, the connectioninformation for the remote session to a proxy that runs on the clientterminal outside the hardware isolated environment; employing, by theproxy, the connection information for the remote session to redirect theUSB device to the server to thereby cause the USB device to becomeaccessible within the remote session.
 11. The computer storage media ofclaim 10, wherein the method further comprises: prior to the VDI clientestablishing the remote session, sending, by an agent that runs in thehardware isolated environment, connection information for the hardwareisolated environment to the proxy; employing, by the proxy, theconnection information for the hardware isolated environment to redirectthe USB device to the hardware isolated environment to thereby cause theUSB device to become accessible within the hardware isolated environmentsuch that the VDI client can employ the USB device to establish theremote session.
 12. The computer storage media of claim 11, wherein theUSB device is an authentication device.
 13. The computer storage mediaof claim 10, wherein the method further comprises: ceasing, by theproxy, the redirection of the USB device to the hardware isolationenvironment in response to receiving the connection information for theremote session.
 14. A method for enabling a USB device that is connectedto a client terminal to be accessed when an application runs in ahardware isolated environment on the client terminal, the methodcomprising: in conjunction with the hardware isolated environment beingcreated on the client terminal, running an agent in the hardwareisolated environment; sending, by the agent, connection information forthe hardware isolated environment to a proxy that runs on the clientterminal outside the hardware isolated environment; and employing, bythe proxy, the connection information to redirect the USB device to thehardware isolated environment to thereby cause the USB device to becomeaccessible to an application that runs in the hardware isolatedenvironment.
 15. The method of claim 14, wherein the application is aVDI client, the method further comprising: receiving, at a notificationservice that runs in the hardware isolated environment, connectioninformation for a remote session that the VDI client has established ona server; sending, by the notification service, the connectioninformation for the remote session to the proxy; employing, by theproxy, the connection information for the remote session to redirect theUSB device to the server to thereby cause the USB device to becomeaccessible within the remote session.
 16. The method of claim 15,wherein the proxy redirects the USB device to the hardware isolatedenvironment to enable the VDI client to employ the USB device toestablish the remote session and then redirects the USB device to theserver.
 17. The method of claim 15, wherein the USB device is anauthentication device.
 18. The method of claim 15, further comprising:receiving, at the notification service, a notification that the remotesession has terminated; sending, by the notification service, acorresponding notification to the proxy; and in response to thecorresponding notification, causing, by the proxy, the USB device to bereturned to the client terminal.
 19. The method of claim 14, wherein theUSB device comprises a USB host controller.
 20. The method of claim 14,wherein the hardware isolated environment is a virtual machine and theapplication is a browser.